Stealing Identities

RAY SUAREZ:

The Atlanta-based company ChoicePoint collects and sells personal information on almost every U.S. Citizen. Last week it revealed that thieves gained access to its information on some 145,000 people nationwide.

They used fake identities to open ChoicePoint accounts giving them access to volumes of data on consumers, including names, addresses, Social Security numbers and credit reports. The thieves were part of an identity theft ring in Los Angeles. So far, 750 people have been defrauded.

In a statement, ChoicePoint said it's: "…going to extraordinary lengths to assist people whose identities may have been compromised by the crimes committed against the company and will continue to do so." Word of the identity theft case got out only after ChoicePoint last week sent warning letters to 35,000 customers in California, the only state with a law that requires disclosure of such security breaches.

ChoicePoint first learned of the information theft in October, but didn't notify affected customers fearing it might jeopardize an ongoing federal investigation. Attorneys general from 19 states recently demanded that ChoicePoint warn any victims in their states as well. And politicians and consumer advocates say the thefts underscore the need for tougher regulation of the consumer data industry. New York Sen. Charles Schumer:

SEN. CHARLES SCHUMER:

We need comprehensive legislation in this brave new world where ID theft is a major crime. We have to make sure people who need to get this information can get it but nobody else.

RAY SUAREZ:

And the Senate Judiciary Committee has announced hearings on the identity theft issue in the coming weeks.

RAY SUAREZ:

For more on the implications of this security breach and similar concerns, I'm joined by Robert O'Harrow. He covers data privacy for the Washington Post and is also the author of "No Place to Hide: Behind the Scenes of our Emerging Surveillance Society;" and Beth Givens, she's the founder and director of the Privacy Rights Clearinghouse, a nonprofit consumer information and advocacy organization.

Robert O'Harrow, what does a company like ChoicePoint collect, and where do they get it from?

ROBERT O’HARROW:

ChoicePoint collects records from a myriad of sources, public records primarily. They buy information from other companies. They collect the names, addresses, address histories for your entire adult life, drivers records, criminal records, what you own, where you live, the list goes on and on.

RAY SUAREZ:

Beth Givens, is this generally material that's collected with the consent of the people it's being collected about?

BETH GIVENS:

No. Really consumers have almost no role to play in this, in fact, virtually none. When you interact with a government agency, you have to give them that information in order to get your driver's license. If you're involved in a court case, you also have to be publicly recorded in the court records.

So the information that ChoicePoint and the other data compilers are compiling is obtained without your consent and it's used for numerous uses. I think up until last week most people didn't know these companies existed and that this type of data was being compiled on them.

RAY SUAREZ:

So Beth Givens, in other words, you could end up with your personal information being stolen from a company that you never knew had it in the first place?

BETH GIVENS:

Well, that's exactly what has happened in this situation. I doubt that many people heard of ChoicePoint, of Lexis Nexus, Axiom. These are the major data compilers. I think people now because of identity theft do know about the credit reporting bureau, Experian, Transunion and Equifax, but the word "ChoicePoint" I think is a new one to people.

RAY SUAREZ:

And, Robert O'Harrow, are there a lot of these companies, meaning there are that many more computers that have your information on file?

ROBERT O’HARROW:

In the 1990s there was in effect a data revolution that was driven by increases in computing power, the expansion of networks and also by our desire for conveniences and discounts. Police use this information to pursue cases. It accelerates investigations, in some cases dramatically, and reporters use this information. I should note that it's going to be an important task to try to maintain access for the world of journalism because we also use it to try to provide accountability and do our jobs.

RAY SUAREZ:

So you mentioned reporters and police agencies. Who else is contacting a company like ChoicePoint and saying, please, I'd like to find out X?

ROBERT O’HARROW:

Well, it's everybody from the CIA to virtually every major federal government agency, local, state and federal law enforcement, as well as all the –not quite all but virtually all the major Fortune 500 companies.

And they use it also to do background screening; volunteers are checked, oftentimes against ChoicePoint and other kinds of databases, and more and more even when you go through checkpoints, ChoicePoint will be behind the scenes or other companies to determine if you are who you claim to be.

RAY SUAREZ:

Beth Givens, what's the upside for the consumer? What is this making easy or different about your life doing business with the rest of the world?

BETH GIVENS:

Well, it's actually, given the situation, it's hard to say that there are upsides. Certainly we've seen the benefits of the consumer reporting industry, the ability to walk into an auto dealership on the weekend and get your auto loan right then and there. That's a benefit of the credit reporting industry, but that industry is quite well regulated by the Fair Credit Reporting Act.

This particular industry is not well regulated, and unfortunately the consumer has been kept out of the equation. And we've seen the implications now for individuals because of the unfortunately poor security in terms of access to those records. So I think what we need to see is more regulation of this industry, factor the consumer into the equation, give the individual the ability to get access to this data, make sure it's accurate, know who has seen that data and in a sense just have more control over the situation. The definition of privacy that we use is the ability of the individual to control what's done with their personal information.

RAY SUAREZ:

Robert O'Harrow, do you agree with Beth Givens that this data compiling is really something different from being able to more quickly get an auto loan or get a department store charge plate or something like that?

ROBERT O’HARROW:

Well, there's a whole world of uses of data. A lot of it is driven by marketing. And that's a convenience that we like. We like having things tailored to our interests. A lot of it is fraud detection. So that's not necessarily credit reports, but it's verifying who someone is, if they show a risk of defaulting and so on. It is very different.

And there has been a dramatic shift. I think enhancing the urgency of at least coming to terms with this is this notion that the government is now outsourcing security and intelligence to these companies like never before since 9/11 because they can compile information about virtually every adult American in ways that the government cannot in some cases by law.

RAY SUAREZ:

Now Beth Givens, you mentioned that there was good regulation of the TRW's and the Experians and so on. Is there no regulation of the ChoicePoints of the world?

BETH GIVENS:

Not in the broader sense. There is regulation of certain uses of the ChoicePoint data, for example, employment screening. If a landlord checking out a potential tenant, the insurance industries use in terms of claims records, specific uses have regulations, but the entire industry as a whole is not regulated. I think we need stronger standards for accountability, for transparency and for security of this industry.

RAY SUAREZ:

So Robert O'Harrow, can a individual consumer take more control, take some of that control back from companies like this and say, no, I want to know when someone wants to see this or I will only give permission for certain things to be seen at certain times? Will a consumer have any power in this transaction?

ROBERT O’HARROW:

Not in the way you described. We do have some control, but the reality is that the information industry has become so intertwined into our economy, and it's such a source of all these conveniences and efficiencies that we like, the financial service industry thrives on information about us to provide these service and so on. It's going to be a long time before an individual can make those kinds of decisions and have them stick. Right now they for the most part can't do that.

RAY SUAREZ:

So Beth Givens, they talk about this being a fast-growing crime, an increasingly common crime. If you find your identity has been stolen, is there anybody to help you?

BETH GIVENS:

Yes, thankfully there's a lot more help for victims these days. The Federal Trade Commission has an identity theft clearinghouse that's available by Web site and by toll-free number. There are numerous resources on the Web, including our own and others. And there are laws that are helping victims recover their identities, and it's important that people take advantage of those.

Also a new law that's just being rolled out across the country is the ability to get a copy of your free credit report or a copy of your credit report for free. The western states, that is available now. In the Midwestern states it will be available starting March 1, and then by September 2005, the rest of the nation. I strongly encourage individuals to take advantage of that. It's most important to check your credit report once if not twice a year, because if you are a victim, that's where you're going to see the evidence.

RAY SUAREZ:

So is this really on its way to being a less nightmarish, less time consuming process once you find, Robert, that your identity has been stolen?

ROBERT O’HARROW:

The victims I've spoken to say that, in fact, it is very much a nightmare and not because they have to shoulder the full cost of the losses. It may be tens of thousands of dollars. The credit issuers and retailers and so on will often shoulder that burden.

But we as Americans typically rate financial privacy and our financial records as sensitive second only to our medical information. People are thrown into a tizzy when they're victims of identity theft. And right now the security measures to really authenticate people and be sure that they are who they claim to be before we give them credit and allow them to charge things and open and close banks bank accounts, they're not sufficient at least according to the examples we've seen, like the one that we witnessed last week.

RAY SUAREZ:

Robert O'Harrow, Beth Givens, thank you both.

BETH GIVENS:

Thank you.